JP5283432B2 - Authentication device, mobile terminal, electric key system, and authentication control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enhance security in a system wherein a user uses a mobile terminal to have a control objective apparatus (e.g. electric lock) operated as prescribed. <P>SOLUTION: From key-distributing server 101 to a mobile phone 102, at least a key-generating data is distributed (701). The mobile phone 102 with a noncontact IC chip 305 is held over with a noncontact IC electric lock, an electric lock controller 104 notifies an optional temporary data to the mobile phone 102 while generating(702) a key data by encryption processing based on a predetermined algorithm from the temporary data and the key-generating data stored in advance. The mobile phone 102 receiving the notice of the temporary data also generates (703) a key data by encryption processing based on the predetermined algorithm from the temporary data and the key-generating data distributed in advance. Then, if the key data generated by the electric lock controller 104 is determined to be coincided with the key data generated by the mobile phone 102, the electric lock is released (704). <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to an authentication device, a mobile terminal, an electric key system, and an authentication control method. More specifically, the present invention relates to a technique in which a user causes a control target device (for example, an electric lock) to perform a predetermined operation (for example, an unlocking operation) using a mobile terminal with a built-in non-contact IC card.

Patent Document 1 below describes the following key management system. That is, the server stores the key ID of the target door, the possession condition of the key, and the opening / closing state of the door, and further holds the application for generating the key and can download the application to a specific mobile phone. ing. When the person with the master key performs a predetermined operation to unlock the electric lock of the target door, the application is downloaded to the person's mobile phone with the master key, and the application To generate a secret key. Thus, a key management system that prevents the key from being inadvertently generated is realized by making it possible to generate the key only in the mobile phone of the person having the master key.
JP 2006-16956 A

  In the above-described prior art, an operation such as transferring the generated secret key from the mobile phone of the person having the master key to another mobile phone is possible. In addition, since the generated key is not temporary key data (for example, data generated based on the temporary data), if the data is leaked, the electric lock of the door is illegally unlocked by another person. was there.

  The present invention has been made in view of the above, and an authentication device and a mobile terminal that can improve security in a system in which a user causes a control target device (for example, an electric lock) to perform a predetermined operation using the mobile terminal. An object is to provide an electric key system and an authentication control method.

An authentication apparatus according to the present invention is an authentication apparatus that authenticates an authentication target to be authenticated by short-range wireless communication and controls the operation of a control target device based on an authentication result. An identifier and key generation data used for generating key data for authentication are stored in advance, the holding means for storing the generated key data, and the proximity of the authentication target are monitored, and the authentication target When the approach of an object is detected, the key data is read from the authentication target, and the key data request signal, the identifier of the control target device, and the temporary data used to generate the key data are transmitted to the authentication target. Encryption for generating key data by encrypting the short-range wireless communication means for performing the operation, the key generation data held in the holding means, and the temporary data, and holding the generated key data in the holding means And the key data read from the authentication object by the short-range wireless communication means and the key data held in the holding means are compared, and if they match, an operation control signal for instructing a predetermined operation is sent If the data does not match, the short-range wireless communication means causes the key data request signal, the identifier of the device to be controlled, and the temporary data to be transmitted to the authentication object, and the encryption means generates the key data. And a control means for controlling.

  According to the present invention, the key data generated by encrypting the temporary data and the key generation data held in advance is compared with the key data read from the authentication object, and based on the comparison result. Thus, the authentication object can be properly authenticated, and if the authentication is successful, the control target device can be instructed to perform a predetermined operation.

  It is desirable that the control means deletes the key data held in the holding means when the key data read from the authentication object matches the key data held in the holding means. In this case, even if the portable terminal holds the previous key data, the previous key data can be invalidated once the control target device is caused to perform a predetermined operation.

  A mobile terminal according to the present invention includes a communication unit that receives an identifier of a device to be controlled and key generation data used for generating key data for authentication from an external server, a key data request signal, and a control target The device identifier and the temporary data used to generate the key data are received, the key data holding means for holding the key data corresponding to the identifier of the device to be controlled, and the key generation data received by the communication means. , A key generation data holding means for holding in association with the identifier of the control target device, and a key generation associated with the identifier of the control target device received at the same time when a key data request signal is received Management control means for determining whether or not key data can be generated on the basis of whether or not data is held by the key generation data holding means, and key data generation by the management control means If it is determined that it is possible, key data is generated by encrypting the key generation data held by the key generation data holding means and the received temporary data, and the generated key data is held as key data. And key data generation means stored in the means.

  According to the present invention, when a key data request signal is received, at least whether the key generation data associated with the identifier of the control target device received simultaneously is held by the key generation data holding means. On the basis of whether or not key data can be generated, and if it is determined to be possible, encrypt the key generation data held by the key generation data holding means and the received temporary data Can generate and hold key data.

  The communication means further receives a key use condition including the number of times key data can be generated and an expiration date of the key generation data, and the management control means further based on whether or not the key use condition is satisfied, It is desirable to determine whether or not key data can be generated. In this case, in addition to whether or not the key generation data associated with the identifier of the device to be controlled is held by the key generation data holding unit, the number of times key data can be generated and the expiration date of the key generation data are included. Whether or not key data can be generated can be determined based on whether or not the key use condition is satisfied, and detailed determination can be made as to whether or not key data can be generated.

  The electric key system according to the present invention includes (1) the authentication device described above, (2) the mobile terminal described above, (3) the identifier of the device to be controlled, and a key used for generating key data for authentication. And a server that transmits the generation data to the mobile terminal.

  An authentication control method according to the present invention includes (a) an authentication control method executed by an authentication device, (b) an authentication control method executed by a mobile terminal, and (c) an authentication control method executed by an electric key system. It can be understood from three angles, and can be described as follows.

  (a) The authentication control method executed by the authentication device monitors the approach of the authentication object to be authenticated, and when detecting the approach of the authentication object, reads the key data from the authentication object; A step of comparing the key data read from the authentication object with the key data held in advance in the authentication device is instructed to perform a predetermined operation when the read key data matches the key data held in advance. When the read key data does not match the previously held key data, the key data request signal, the identifier of the control target device, and the temporary data are sent to the authentication target object. And generating the key data by encrypting the key generation data held in advance and the temporary data, and holding the generated key data. To.

  (b) An authentication control method executed by a mobile terminal includes receiving an identifier of a device to be controlled and key generation data used for generating key data for authentication from an external server; Storing the key generation data in association with the identifier of the control target device; receiving the key data request signal, the control target device identifier, and temporary data used to generate the key data; When a key data request signal is received, at least based on whether or not key generation data associated with the identifier of the control target device received at the same time is held in advance in the mobile terminal The key data is encrypted by encrypting the stored key generation data and the received temporary data when it is determined that the key data can be generated. Generated, the step of holding the generated key data, characterized by having a.

  (c) In the authentication control method executed by the electric key system, the mobile terminal receives the identifier of the device to be controlled and the key generation data used for generating the key data for authentication from the server; The mobile terminal stores the received key generation data in association with the identifier of the control target device, and the authentication device monitors the approach of the authentication target to be authenticated, and the approach of the authentication target The key data read from the authentication object, the authentication device compares the key data read from the authentication object with the key data held in advance in the authentication device, and the authentication device. However, when the read key data does not match the previously held key data, the key data request signal, the identifier of the control target device, and the temporary data are transmitted to the authentication target. Generating key data by encrypting pre-stored key generation data and temporary data, and storing the generated key data; and a mobile terminal sends a request signal for key data, a control target device The step of receiving the identifier and the temporary data used to generate the key data, and when the mobile terminal receives the request signal for the key data, associate at least the identifier of the control target device received at the same time Determining whether or not key data can be generated based on whether or not the generated key generation data is held in advance in the mobile terminal, and holding if the mobile terminal determines that key data can be generated Encrypting the generated key generation data and the received temporary data to generate key data, holding the generated key data, and the authentication device to be authenticated When the approach of the authentication object is monitored and the approach of the authentication object is detected, the step of re-reading the key data from the authentication object, and the authentication device reads the key data read from the authentication object and the authentication device The step of comparing again with the pre-stored key data and the operation control signal for instructing a predetermined operation when the authentication device matches the read key data with the pre-held key data. And a step of transmitting to.

  ADVANTAGE OF THE INVENTION According to this invention, a user can improve security in the system which makes a control object apparatus perform predetermined | prescribed operation | movement using a mobile terminal.

  Exemplary embodiments of an electric key system according to the present invention will be described below in detail with reference to the accompanying drawings.

[Electric key system and configuration of each device]
FIG. 1 is a schematic diagram of an electric key system 10 according to an embodiment of the present invention. As shown in FIG. 1, the electric key system 10 includes a key distribution server device 101, a mobile phone 102, and an electric lock control device 104. The mobile phone 102 can be connected to the key distribution server apparatus 101 via the network 106. The electric lock control device 104 is connected to the non-contact IC read / write device 103 and the electric lock 105 to be controlled. When the mobile phone 102 having the non-contact IC chip 305 mounted on the non-contact IC read / write device 103, the electric lock control device 104 is stored in the non-contact IC chip 305 via the non-contact IC read / write device 103. It is possible to read data, transmit data to the mobile phone 102, and generate key data generation requests (for example, start a key data generation application). The key distribution server device 101 corresponds to a server according to the present invention, the mobile phone 102 corresponds to a mobile terminal according to the present invention, and the electric lock control device 104 corresponds to an authentication device according to the present invention.

  The functional outline of each device will be described below.

  The key distribution server apparatus 101 holds the door identifier and key generation data allocated to each of the plurality of electric lock control apparatuses 104, and the door identifier and key allocated to the electric lock 105 at a timing described later. The number of uses and the expiration date of the generation data and key generation data are distributed to the mobile phone 102.

  The electric lock control device 104 holds a door identifier and key generation data allocated to the electric lock 105 to be controlled. When the mobile phone 102 is deceived by the non-contact IC read / write device 103, the non-contact IC The key data in the chip 305 is read, and it is determined whether or not the read key data matches the key data generated by the electric lock control device 104 at a timing described later. The electric lock control device 104 controls the unlocking of the electric lock 105 if they match, and if not, the electric lock control device 104 sends the door identifier of the electric lock 105 and temporary data composed of arbitrary data to the mobile phone 102. Notify and request generation of key data. The temporary data is notified of different random data every time.

  The mobile phone 102 holds the door identifier, key generation data, the number of times the key generation data is used, and the expiration date distributed from the key distribution server device 101. When the notification is received from the electric lock control device 104, the key generation data corresponding to the notified door identifier is identified from the stored key generation data, and the key is generated from the key generation data and the notified temporary data. Data is generated, and the generated key data is held in the non-contact IC chip 305.

  The functional block configuration of each device will be outlined below.

  FIG. 2 shows a functional block configuration of the electric lock control device 104. The electric lock control device 104 includes an electric lock control unit 201, a non-contact IC read / write control unit 202, a key generation data holding unit 203, a key data memory 204, an encryption processing unit 205, a management control unit 206, and a communication unit 207. I have. The key generation data holding unit 203 and the key data memory 204 correspond to the holding unit of the authentication device according to the present invention, and the non-contact IC read / write control unit 202 and the communication unit 207 are close to the authentication device according to the present invention. The encryption processing unit 205 corresponds to the distance wireless communication unit, the encryption unit of the authentication device according to the present invention, and the electric lock control unit 201 and the management control unit 206 are the control unit of the authentication device according to the present invention. It corresponds to.

  Among these, the management control unit 206 controls and manages the operation of each unit in the electric lock control device 104. The electric lock control unit 201 performs unlocking control of the electric lock 105 (FIG. 1) according to an instruction from the management control unit 206. The non-contact IC read / write control unit 202 reads key data from the non-contact IC chip 305 (FIG. 1) mounted on the mobile phone 102 according to an instruction from the management control unit 206, and a door identifier for the mobile phone 102. A temporary data notification or key data generation request is made. The key generation data holding unit 203 holds key generation data of its own electric lock control device 104. The encryption processing unit 205 generates key data from the stored key generation data and temporary data. The key data memory 204 holds key data generated by the encryption processing unit 205. The communication unit 207 communicates with each of the electric lock 105 and the non-contact IC read / write device 103.

  FIG. 3 shows a functional block configuration of the mobile phone 102. The mobile phone 102 includes a key generation data holding unit 301, an encryption processing unit 302, a management control unit 303, and a communication unit 304, and further includes a non-contact IC chip 305. The communication unit 304 corresponds to the communication means of the mobile terminal according to the present invention, the non-contact IC chip 305 corresponds to the key data holding unit of the mobile terminal according to the present invention, and the key generation data holding unit 301 , Corresponding to key generation data holding means of the mobile terminal according to the present invention, the management control unit 303 corresponds to management control means of the mobile terminal according to the present invention, and the encryption processing unit 302 corresponds to the mobile terminal according to the present invention. This corresponds to the key data generation means of the terminal.

  Among these, the management control unit 303 controls and manages the operation of each unit in the mobile phone 102. The key generation data holding unit 301 holds the door identifier, key generation data, the number of uses of the key generation data, and the expiration date distributed from the key distribution server device 101 (FIG. 1). The non-contact IC chip 305 holds key data and communicates with the non-contact IC read / write device 103. The communication unit 304 communicates with the key distribution server apparatus 101. When the encryption processing unit 302 receives the key data generation request and the notification of the door identifier and the temporary data from the electric lock control device 104, the encryption processing unit 302 uses the key generation data that is held to correspond to the key corresponding to the notified door identifier. The generation data is specified, and the key data is generated from the key generation data and the notified temporary data. Further, the encryption processing unit 302 holds the generated key data in the non-contact IC chip 305.

  FIG. 4 shows a functional block configuration of the key distribution server apparatus 101. The key distribution server apparatus 101 includes a key generation data holding unit 401, a management control unit 402, and a communication unit 403. Among these, the key generation data holding unit 401 holds a door identifier and key generation data allocated to each of the plurality of electric lock control devices 104. The communication unit 403 performs communication with the outside (for example, the mobile phone 102). The management control unit 402 distributes the door identifier, key generation data, the number of uses of the key generation data, and the expiration date of the key generation data to the mobile phone 102 via the communication unit 403 at a timing described later.

[Processing in the electric key system]
Hereinafter, as processing in the electric key system, (1) key data generation processing by the mobile phone 102 (FIG. 5), (2) electric lock unlocking control processing by the electric lock control device 104 (FIG. 6), (3) electric Processing in the entire key system (FIG. 7) will be described in order.

  First, a key data generation process executed by the mobile phone 102 will be described with reference to FIG.

  The mobile phone 102 has received and received the door identifier distributed from the key distribution server device 101 at a predetermined timing to be described later, the key generation data associated with the door identifier, the number of times the key generation data is used, and the expiration date. The data is held in the key generation data holding unit 301 (step 501).

  When the user places the mobile phone 102 over the non-contact IC read / write device 103 corresponding to the electric lock 105 to be unlocked, the key data is read from the key data area of the non-contact IC chip 305 by the electric lock control device 104. (Step 502). Thereafter, the electric lock control device 104 performs unlocking control processing based on determination of key data, which will be described later, using the read key data. In the unlocking control process, when control that does not unlock is performed, the door identifier and temporary data are notified from the electric lock control device 104 via the non-contact IC read / write device 103 within a predetermined time.

  Therefore, the cellular phone 102 determines whether or not the door identifier and the temporary data are notified from the electric lock control device 104 within a predetermined time (step 503). Here, if the door identifier and the temporary data are not notified from the electric lock control device 104 within a predetermined time, it can be determined that the unlocking control has been performed, and thus the processing of FIG. 5 is terminated.

  On the other hand, when the door identifier and temporary data are notified from the electric lock control device 104 within a predetermined time, the mobile phone 102 is notified from the key generation data held in the key generation data holding unit 301. An attempt is made to specify key generation data corresponding to the door identifier (step 504). Here, if the key generation data corresponding to the notified door identifier cannot be specified, the key data cannot be generated, and thus the processing in FIG. 5 is terminated. On the other hand, if the key generation data corresponding to the notified door identifier can be identified, it is confirmed that the key generation data is within the expiration date and the number of key data generations has not been exceeded (step 505). Here, if the expiration date of the key generation data has passed or the number of times key data can be generated has been exceeded, the key data cannot be generated, and thus the processing of FIG. 5 is terminated. On the other hand, if the key generation data is within the validity period and the number of times that key data can be generated has not been exceeded, the encryption processing unit 302 converts the corresponding temporary data notified of the key generation data into a predetermined encryption. The key data is generated by encrypting with the encryption algorithm, and the generated key data is held in the non-contact IC chip 305. At this time, the key data generation count of the corresponding key generation data is increased by one (step 506).

  Next, the electric lock unlocking control process executed by the electric lock control device 104 will be described with reference to FIG. The key generation data holding unit 401 of the electric lock control device 104 registers a door identifier and key generation data associated with the door identifier in advance.

  When the mobile phone 102 is trapped by the non-contact IC read / write device 103, the electric lock control device 104 stores the data in the key data area of the non-contact IC chip 305 (that is, key data held in the non-contact IC chip 305). Read (step 601).

  Next, the electric lock control device 104 compares the read key data with the key data stored in the key data memory 204 (step 602). Here, if they match, the electric lock 105 is unlocked and the key data stored in the key data memory 204 is deleted (step 603).

  On the other hand, if the two do not match in step 602, the electric lock control device 104 notifies the mobile phone 102 via the non-contact IC read / write device 103 of the door identifier of the electric lock 105 and temporary data composed of arbitrary data. And request to generate key data (step 604).

  Then, the electric lock control device 104 encrypts its own key generation data (that is, key generation data held in the key generation data holding unit 401) and the notified temporary data with a predetermined encryption algorithm. Thus, key data is generated, and the generated key data is held in the key data memory 204 (step 605).

  Next, the flow of processing in the entire electric key system will be described with reference to FIG.

  The key distribution server device 101 distributes to the mobile phone 102 the door identifier distributed from the key distribution server device 101 at a predetermined timing, the key generation data associated with the door identifier, the number of times the key generation data is used, and the expiration date. Then, the cellular phone 102 holds the received data in the key generation data holding unit 301 (sequence 701). In addition, as the predetermined timing, for example, after the settlement of the fee for using the real estate property or facility is completed (for example, after payment of the rent or entrance fee) or after the specific authentication process is completed (for example, the member) Or after the completion of authentication with a certificate or after the issuance of a new membership card). The distribution from the key distribution server device 101 is not automatically executed by the key distribution server device 101 at the timing as described above, but the user manually requests distribution from the mobile phone 102 to the key distribution server device 101. Alternatively, a distribution request may be made from the mobile phone 102 to the key distribution server apparatus 101 in accordance with an instruction from the electric lock control apparatus 104.

  Next, when the user places the mobile phone 102 over the non-contact IC read / write device 103 corresponding to the electric lock 105 to be unlocked, the key data is read from the key data area of the non-contact IC chip 305 by the electric lock control device 104. Then, the electric lock control device 104 compares the read key data with the key data stored in the key data memory 204 (execution of key data verification). If the two do not match, the electric lock control device 104 notifies the mobile phone 102 via the non-contact IC read / write device 103 of the door identifier of the electric lock 105 and temporary data composed of arbitrary data. And request generation of key data. Specifically, the notification of the door identifier and temporary data of the electric lock 105 and the key data generation request reach the non-contact IC chip 305, and the non-contact IC chip 305 transmits the door identifier and temporary data to the mobile phone 102. At the same time, the management control unit 303 of the mobile phone 102 is activated. At the same time, the electric lock control device 104 generates key data by encrypting the key generation data registered in the key generation data holding unit 401 and the notified temporary data with a predetermined encryption algorithm. The generated key data is held in the key data memory 204 (sequence 702).

  Next, the management control unit 303 of the mobile phone 102 identifies the key generation data corresponding to the notified door identifier from the key generation data held in the key generation data holding unit 301, and the corresponding key. It is confirmed that the generation data is within the valid period and the number of times key data can be generated has not been exceeded. Here, if the key generation data is within the valid period and the number of times that key data can be generated has not been exceeded, the encryption processing unit 302 converts the corresponding temporary data notified of the key generation data into a predetermined encryption. The key data is generated by encrypting with the encryption algorithm, and the generated key data is held in the non-contact IC chip 305 (sequence 703).

  After that, when the user turns the mobile phone back on the contactless IC read / write device 103 again, the key data is read from the key data area of the contactless IC chip 305 by the electric lock control device 104, and the electric lock control device 104 reads The received key data is compared with the key data stored in the key data memory 204 (execution of key data verification). If the two match, the electric lock control device 104 unlocks the electric lock 105 and deletes the key data stored in the key data memory 204 (sequence 704).

  In the electric key system described above, key data generated by encrypting different random temporary data and pre-stored key generation data each time, and key data read from the non-contact IC chip 305, The mobile phone 102 can be properly authenticated if both match, and the electric lock 105 can be unlocked only when the authentication is successful.

  Note that an existing technique such as triple DES is used for the encryption process for generating key data in the above embodiment.

  In the above embodiment, the electric lock control device does not manage the expiration date of the key generation data, but may manage the expiration date of the key generation data. In that case, for example, an embodiment in which a plurality of key generation data is registered in advance at the time of shipping an electric lock, and the current key generation data is switched to the new key generation data when the expiration date comes, or the current key An embodiment in which new key generation data is acquired via the network at the timing when the generation data expires can be employed. Thereby, it can have stronger security performance.

  Also, when the key generation data is distributed from the key distribution server device to the mobile phone, the payment processing is linked and the door identifier and the key generation data are distributed to the mobile phone when the payment processing is completed. May be. Specifically, (1) after completion of the payment process, the link to the key generation data is sent to the email address of the corresponding mobile phone, and the terminal has been settled by the terminal unique number or SIM number at the time of payment If it is determined, the processing procedure for downloading the door identifier and key generation data to the mobile phone, or (2) after the settlement process is completed, the passcode is notified to the mobile phone user, and the passcode is notified to the key distribution server device. Thus, a processing procedure similar to the existing content download, such as a processing procedure for downloading the door identifier and key generation data to the mobile phone, may be adopted.

  Further, the key generation data and encryption algorithm registered in the electric lock control device may be periodically updated by connecting the electric lock control device to the network. Even in this case, it is natural that the connection is not always necessary.

  In the prior art, when a new terminal to be authenticated is used, the ID of the new terminal must be registered in an electric lock side device (for example, an electric lock control device). Therefore, the electric lock side device is connected to the network. I had to. On the other hand, in the present invention, when a new terminal to be authenticated is used, specific secret information is used instead of the new terminal ID, so it is not necessary to register the new terminal ID in the device on the electric lock side. Thus, there is an advantage that there is no need to connect the device on the electric lock side to the network.

  Further, as described in the sequence 703 of FIG. 7, when generating the key data by the encryption processing unit 302 of the mobile phone 102, user authentication (for example, authentication using the input user ID and password) is performed. Also good.

1 is a schematic diagram of an electric key system according to an embodiment of the present invention. It is a functional block block diagram of an electric lock control apparatus. It is a functional block block diagram of a mobile telephone. It is a functional block block diagram of a key distribution server apparatus. It is a flowchart which shows the procedure for a mobile telephone to produce | generate key data. It is a flowchart which shows the procedure for an electric lock control apparatus to unlock an electric lock. It is a sequence diagram which shows the process sequence in the whole electric key system.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Electric key system, 101 ... Key distribution server apparatus, 102 ... Mobile phone, 103 ... Non-contact IC reading / writing apparatus, 104 ... Electric lock control apparatus, 105 ... Electric lock, 106 ... Network, 201 ... Electric lock control part, 202 ... Non-contact IC read / write control unit, 203 ... Key generation data holding unit, 204 ... Key data memory, 205 ... Encryption processing unit, 206 ... Management control unit, 207 ... Communication unit, 301 ... Key generation data holding unit, 302 ... Encryption processing unit 303 ... Management control unit 304 ... Communication unit 305 ... Non-contact IC chip 401 ... Key generation data holding unit 402 ... Management control unit 403 ... Communication unit

Claims (8)

An authentication device that authenticates an object to be authenticated by short-range wireless communication and controls the operation of a control target device based on an authentication result,
Holding means for holding the identifier of the control target device and key generation data used for generating key data for authentication in advance, and holding generated key data;
When the approach of the authentication target is monitored and the approach of the authentication target is detected, the key data is read from the authentication target, and the key data request signal, the identifier of the control target device, and Short-range wireless communication means for performing an operation of transmitting temporary data used for generating the key data to the authentication target;
Encrypting means for generating key data by encrypting the key generation data held in the holding means and the temporary data, and holding the generated key data in the holding means;
The key data read from the object to be authenticated by the short-range wireless communication means is compared with the key data held in the holding means, and when they match, an operation control signal for instructing a predetermined operation is sent to the control object When it is transmitted to a device and does not match, the short-range wireless communication means causes the key data request signal, the identifier of the device to be controlled, and the temporary data to be transmitted to the authentication object, and the encryption means Control means for controlling the key data to be generated by
An authentication device comprising: The control means deletes the key data held in the holding means when the key data read from the authentication object matches the key data held in the holding means. The authentication device according to claim 1. A communication means for receiving an identifier of the control target device and key generation data used for generating key data for authentication from an external server;
A key data holding means for receiving a key data request signal, an identifier of the device to be controlled, and temporary data used to generate the key data, and holding key data corresponding to the identifier of the device to be controlled;
Key generation data holding means for holding the key generation data received by the communication means in association with the identifier of the device to be controlled;
When the key data request signal is received, at least whether the key generation data associated with the identifier of the control target device received simultaneously is held by the key generation data holding means. As a basis, management control means for determining whether or not key data can be generated,
When it is determined by the management control means that key data can be generated, the key data is encrypted by encrypting the key generation data held by the key generation data holding means and the received temporary data. Key data generating means for generating and holding the generated key data in the key data holding means;
Mobile terminal equipped with. The communication means further receives a key use condition including the number of times key data can be generated and an expiration date of key generation data,
The mobile terminal according to claim 3, wherein the management control means further determines whether or not key data can be generated based on whether or not the key use condition is satisfied. An authentication device according to claim 1;
A mobile terminal according to claim 3;
A server that transmits the identifier of the control target device and key generation data used to generate key data for authentication to the mobile terminal;
An electric key system composed of. An authentication control method executed by an authentication device,
Monitoring the approach of an authentication object to be authenticated and, when detecting the approach of the authentication object, reading key data from the authentication object;
Comparing the key data read from the authentication object with the key data held in advance in the authentication device;
When the read key data matches the previously held key data, an operation control signal for instructing a predetermined operation is transmitted to the control target device, and the read key data and the previously held key data are transmitted. When the key data does not match, the key data request signal, the identifier of the device to be controlled, and the temporary data are transmitted to the authentication object, and the previously generated key generation data and the temporary data are encrypted. Generating key data by storing the generated key data, and holding the generated key data;
An authentication control method comprising: An authentication control method executed by a mobile terminal,
Receiving an identifier of the control target device and key generation data used to generate key data for authentication from an external server;
Storing the received key generation data in association with the identifier of the device to be controlled;
Receiving a key data request signal, an identifier of the device to be controlled, and temporary data used to generate the key data;
When the request signal for the key data is received, at least based on whether or not key generation data associated with the identifier of the control target device received at the same time is held in advance in the mobile terminal, Determining whether key data can be generated; and
A step of generating key data by encrypting the held key generation data and the received temporary data when it is determined that key data can be generated; and holding the generated key data; ,
An authentication control method comprising: An authentication control method executed in an electric key system including an authentication device, a mobile terminal, and a server,
The mobile terminal receiving an identifier of the device to be controlled and key generation data used for generating key data for authentication from the server;
The mobile terminal holding the received key generation data in association with the identifier of the device to be controlled;
When the authentication device monitors the approach of an authentication object to be authenticated and detects the approach of the authentication object, reading key data from the authentication object;
The authentication device comparing key data read from the authentication object with key data held in advance in the authentication device;
The authentication device transmits a request signal for the key data, an identifier of the device to be controlled, and temporary data to the authentication object when the read key data does not match the previously held key data. And generating the key data by encrypting the pre-stored key generation data and the temporary data, and holding the generated key data;
The mobile terminal receiving a key data request signal, an identifier of the device to be controlled, and temporary data used to generate the key data;
When the mobile terminal receives a request signal for the key data, at least whether or not key generation data associated with the identifier of the control target device received at the same time is held in advance in the mobile terminal And determining whether or not key data can be generated based on
When the mobile terminal determines that key data can be generated, it generates key data by encrypting the stored key generation data and the received temporary data, and the generated key data A step of holding
When the authentication device monitors the approach of an authentication object to be authenticated and detects the approach of the authentication object, the key data is read again from the authentication object;
The authentication device again compares the key data read from the authentication object with the key data held in advance in the authentication device;
A step of transmitting an operation control signal instructing a predetermined operation to a device to be controlled when the authentication device matches the read key data with previously held key data;
An authentication control method comprising:

Images